NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.15 01:11
wwbizsrvs.exe
11.15 01:11
op.exe
11.15 01:11
msf.exe
11.15 01:11
lum250.exe
11.15 01:11
msf443.exe
11.13 04:11
hello.exe
11.13 03:11
espsemhvcioff.exe
11.13 02:11
Geek_se.exe
11.13 02:11
cred64.dll
11.13 02:11
svhost.exe

Latest News
11.16 01:11
How Runtime Insights H...
11.16 01:11
Akamai?s Perspective o...
11.16 12:11
김수키 에서 만든 피싱 사이트 동덕여자대...
11.16 12:11
This Week in Security:...
11.16 12:11
Sintesi riepilogativa ...
11.16 12:11
Babble Babble Babble B...
11.16 12:11
Updated whitepaper: Ar...
11.16 12:11
Wie KI räumliche Vorst...
11.16 12:11
Whatsapp erinnert euch...
11.16 12:11
SaaS für Standards dig...

NetWork | ZeroBOX

IP Address	Status	Action
164.124.101.2	Active	Moloch
204.152.210.2	Active	Moloch
212.32.237.92	Active	Moloch
34.102.136.180	Active	Moloch
66.70.196.224	Active	Moloch

Name	Response	Post-Analysis Lookup
www.welcomehotelayodhya.com	CNAME welcomehotelayodhya.com A 34.102.136.180	34.102.136.180
www.mercaderlatino.com	CNAME mercaderlatino.com A 66.70.196.224	66.70.196.224
www.clansix.xyz
www.stearmanestates.com	A 212.32.237.92	23.82.12.29
www.shmily.life	A 204.152.210.2 CNAME shmily.life	204.152.210.2
www.randomwebdeal.com
www.ranchodelacruzvs.com	CNAME ranchodelacruzvs.com A 34.102.136.180	34.102.136.180

TCP Requests

UDP Requests

GET 403 http://www.welcomehotelayodhya.com/ixwn/?8pz0LDE8=qjvzSjl7skD9Hg/8/n8Cjg31FU6b/JFZWSvkm31TtA5hAOK5pyCZait3i2aR747SMvjLcBRa&RP=7nEhZ26

GET 302 http://www.stearmanestates.com/ixwn/?8pz0LDE8=PkY2LXPL09alOD3qGBEF3fMC5B3U3PtoZvxzIF6+qIzE93zt01O16VYh4KmIaOIucNOJ/xa8&RP=7nEhZ26

GET 403 http://www.ranchodelacruzvs.com/ixwn/?8pz0LDE8=/krYhVSoSpWYzjtDe6t1nk6sKYh5ZS2LRlcBEA7Sxn2y4uPoi5a4H6+Aay2be7O4TiE84hcX&RP=7nEhZ26

GET 404 http://www.mercaderlatino.com/ixwn/?8pz0LDE8=L568g1mOp87NP80nQPt16c90tFYgM6io8WM3AutAI5iBx5aveoyLxujEnLfB3J/R2gp75EB5&RP=7nEhZ26

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49167 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 66.70.196.224:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 66.70.196.224:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 66.70.196.224:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
UDP 192.168.56.102:59731 -> 164.124.101.2:53	2027867	ET INFO Observed DNS Query to .life TLD	Potentially Bad Traffic
TCP 192.168.56.102:49168 -> 212.32.237.92:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 212.32.237.92:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 212.32.237.92:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts